Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    898ea65be791fa9a7cbb12191c5adfd17bd65b0eef3ae87a49e9b6af1946b1ce

  • Size

    1.1MB

  • Sample

    230419-q57r2acg3s

  • MD5

    95bec7eb1582f79d6283e99623cdb6e0

  • SHA1

    e37554f3b4a7962520e1a1abd913d574296698dc

  • SHA256

    898ea65be791fa9a7cbb12191c5adfd17bd65b0eef3ae87a49e9b6af1946b1ce

  • SHA512

    8e75c6c1486739e548f1e04ad853c0eb3bdeb0cf3101e5939a620b579f58712bbd2874832111790d6a56e573576430e41ba894f4323749df98942c923c893002

  • SSDEEP

    24576:iyveKNtJJjcks0xJxIDY5nEEe2xqj0M5jDCrp1wIHed:JvTNtjF19Ez2xqhu8ge

Score
10/10
amadeyauroradiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Extracted

Family

aurora

C2

89.208.103.78:8081

Targets

    • Target

      898ea65be791fa9a7cbb12191c5adfd17bd65b0eef3ae87a49e9b6af1946b1ce

    • Size

      1.1MB

    • MD5

      95bec7eb1582f79d6283e99623cdb6e0

    • SHA1

      e37554f3b4a7962520e1a1abd913d574296698dc

    • SHA256

      898ea65be791fa9a7cbb12191c5adfd17bd65b0eef3ae87a49e9b6af1946b1ce

    • SHA512

      8e75c6c1486739e548f1e04ad853c0eb3bdeb0cf3101e5939a620b579f58712bbd2874832111790d6a56e573576430e41ba894f4323749df98942c923c893002

    • SSDEEP

      24576:iyveKNtJJjcks0xJxIDY5nEEe2xqj0M5jDCrp1wIHed:JvTNtjF19Ez2xqhu8ge

    Score
    10/10
    amadeyauroradiscoveryevasionpersistencespywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks